Productive

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:32 AM UTC
• Version: 1.0.3

Overview

This Productive integration is mostly purpose-aligned, but it includes an unsafe first-time install path that can execute remote code and it can modify or delete business data.

Review before installing. The Productive actions are clearly disclosed and write/delete operations require confirmation, but do not let an agent run the provided curl-to-bash or PowerShell installer automatically; install the oo CLI through a verified method and be careful with Productive tasks that create, update, or delete business records.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:62

Finding

Unverified Remote Installation Scripts Executed Directly by Shell Interpreters

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 62–66
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The installation instructions retrieve mutable scripts from external URLs and immediately pass their contents to bash or PowerShell's Invoke-Expression. The downloaded payload is neither displayed for review nor stored separately before execution.

The instructions do not pin a release version, validate a cryptographic checksum, verify a publisher signature, or otherwise establish the integrity of the executed code. HTTPS protects the connection in transit but does not ensure that the script currently hosted at the endpoint is trustworthy or identical to the version intended when the Skill was audited.

Installing the oo CLI may be necessary for the declared Productive integration, but directly executing an unverified network response exceeds the minimum mechanism necessary to install that dependency. The effective code executed by these commands can change after the Skill has been reviewed.

Attack Path

1. An attacker compromises the OOMOL website, deployment pipeline, hosting account, DNS configuration, TLS termination infrastructure, or installation-script publishing process.
2. The attacker replaces either installation script with a malicious payload.
3. The Skill encounters an oo: command not found error and presents or follows the first-time setup instructions.
4. The remote response is passed directly to bash or Invoke-Expression without integrity verification or inspection.
5. The malicious script executes with the privileges of the user or agent process.
6. The payload can access resources available to that process, modify ...[truncated 944 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both direct pipe-to-interpreter installation commands.
2. Prefer installation through a reputable platform package manager using an explicitly pinned CLI version.
3. If standalone artifacts are required:
   • Download the artifact to a local file without executing it.
   • Use a version-specific, immutable release URL.
   • Verify a publisher signature or a SHA-256 digest obtained through a separately authenticated channel.
   • Abort installation if verification fails.
   • Inspect the downloaded script before execution.
4. Require explicit, informed user approval before installing software or executing any downloaded file.
5. Run installation with ordinary user privileges and avoid sudo, administrator elevation, or access to unrelated secrets.
6. Document the expected release version, verified digest, publisher identity, installation destination, and files modified by the installer.
7. Where possible, direct users to a signed package or manually reviewed installation guide rather than evaluating remote script content.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill instructs the agent to install software via curl ... | bash, which executes a remotely fetched script without verification. If the distribution endpoint, network path, or hosting account is compromised, this can lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description says to use this skill for "ANY Productive request," which is an overly broad activation trigger for a skill that can create, update, and delete data. This can cause the agent to route loosely related requests into a high-privilege integration and perform unintended state-changing actions if user intent is ambiguous.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.